Skip to content
SPECIFICTION
Get listed

Malcolm

idaholab.github.io

WebWindowsmacOSLinuxAPISelf-hosted
Visit idaholab.github.io
Spec score 7.8 #19 of 32 in Network Packet Analyzer Software

What it is

Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.

Spec sheet

Purpose
Malcolm is an easily deployable network traffic analysis tool suite for security monitoring.Read 1 Oct 2026 · idaholab.github.io
Deployment
Malcolm runs as isolated software containers and can be deployed with Docker, Podman or Kubernetes, including AWS Kubernetes deployments.Read 1 Oct 2026 · idaholab.github.io
API
Malcolm provides a REST API and forwards requests to Logstash, OpenSearch, NetBox and Arkime APIs.Read 30 Sep 2026 · idaholab.github.io
Integrations
Components include NetBox for asset-inventory enrichment, Keycloak for identity and access management, and nginx-auth-ldap for LDAP authentication.Read 1 Oct 2026 · idaholab.github.io
Security
Communications between Malcolm interfaces and remote log forwarders use industry-standard encryption protocols.Read 1 Oct 2026 · idaholab.github.io
License
Malcolm source code is released under the Apache License, version 2.0.Read 1 Oct 2026 · idaholab.github.io
Analysis interfaces
Enriched data is analyzed through OpenSearch Dashboards and Arkime, with prebuilt dashboards and network-session search.Read 1 Oct 2026 · idaholab.github.io
Authentication
The documentation includes local accounts, LDAP authentication, TLS certificates and Keycloak-based authentication and roles.Read 30 Sep 2026 · idaholab.github.io
Data enrichment
Malcolm adds GeoIP, hardware-manufacturer, asset-inventory and JA4 fingerprinting enrichments.Read 1 Oct 2026 · idaholab.github.io
Deployment limitation
Rootless Podman cannot capture traffic on local network interfaces, although it can accept metadata forwarded from a network sensor appliance.Read 1 Oct 2026 · idaholab.github.io
Deployment model
Malcolm runs as a cluster of containers and can also be packaged as a standalone Debian-based installer ISO.Read 30 Sep 2026 · idaholab.github.io
Hardening
The ISO-installed aggregator environment uses hardening scripts targeting CIS recommendations and adapted DISA STIG checks.Read 1 Oct 2026 · idaholab.github.io
ICS focus
Its creators are developing additional parsers for protocols used in industrial-control-system environments.Read 1 Oct 2026 · idaholab.github.io
Input data
It processes PCAP files and Zeek logs, including locally generated, locally captured and offline artifacts.Read 1 Oct 2026 · idaholab.github.io
Installer warning
The installer has no partitioning confirmations and will partition and format all non-removable storage media without warning.Read 30 Sep 2026 · idaholab.github.io
Podman limitation
With rootless Podman, Malcolm cannot capture traffic on local network interfaces, although it can accept metadata forwarded from a network sensor appliance.Read 30 Sep 2026 · idaholab.github.io
Supply-chain security
Official Malcolm container images are automatically scanned with Trivy for vulnerabilities and misconfigurations.Read 1 Oct 2026 · idaholab.github.io
Support and training
The Malcolm program team provides contact through [email protected] and lists general and technical virtual orientations.Read 1 Oct 2026 · inl.gov
Support contact
The project lists [email protected] as the author contact address.Read 30 Sep 2026 · github.com
Supported hosts
Official host-configuration documentation is provided for Linux, macOS and Windows.Read 30 Sep 2026 · idaholab.github.io
Target users
The project describes use in security operations centers, smaller networks, home environments and field incident-response engagements.Read 30 Sep 2026 · idaholab.github.io
Traffic enrichment
Malcolm enriches network session data with GeoIP, MAC-vendor, asset-inventory and JA4 fingerprinting lookups.Read 30 Sep 2026 · idaholab.github.io
Use cases
The project targets long-term SOC deployments, incident-response engagements, smaller networks and home use.Read 1 Oct 2026 · idaholab.github.io
Web access
Its analysis interfaces are accessed through a web browser from analyst workstations or SOC displays.Read 1 Oct 2026 · idaholab.github.io

Strong points and limits

Strong points

  • Accepts PCAP files, Zeek logs and Suricata alerts.
  • Supports live traffic through lightweight forwarders.
  • Includes OpenSearch Dashboards and Arkime interfaces.
  • Offers Docker, Podman and Kubernetes deployment options.

Limits

  • Rootless Podman cannot capture local interface traffic.
  • Installer formats non-removable storage without warning.
  • Requires container-based or Debian ISO deployment.

Who it suits

Malcolm suits security operations teams, incident responders and people monitoring smaller or home networks. It is also described for field engagements, but deployment choices matter, particularly rootless Podman capture and the installer's storage behavior.

Verdict

Malcolm offers multiple ways to ingest and analyze network traffic, with browser-based interfaces and deployment options. Plan carefully around rootless Podman capture limits and the installer's destructive storage behavior.

Where Specifiction places it

Alternatives to MalcolmAll alternatives →